US Patent 10581886 Computer system anomaly detection

An event-analysis system detects anomalies in the operation of a service by processing operational logs, trace files, and event databases produced by the service in accordance with a hierarchical behavioral profile. The event analysis system converts the operational logs, trace files, and event databases into a normalized event stream which is sent to an analysis engine. The analysis engine converts the stream of normalized events to a set of metrics maintained in association with the profile hierarchy. Operational anomalies of the service are detected by analyzing incoming events in the context of metrics maintained in association with applicable leaf-node profiles, root node profiles, and intermediate node profiles.